Despite the advantages of FL, the decentralized nature of its training phase exposes the previous three scenarios to new attack surfaces [1]}. In particular, malicious participants executing adversarial attacks to affect the trustworthiness of FL models are one of the most representative cybersecurity concerns of this paradigm. More in detail, malicious participants could join the federation to disrupt, corrupt, or delay the model learning process [2]}. Another well-known target of adversaries is to infer sensitive information from other participants, but it is out of the scope of this work [3]}. To destroy the global model performance, the literature has documented several data and model falsification attacks consisting of poisoning data, labels, or weights during training [4]}. The detection and mitigation of these attacks are challenging tasks since there is a trade-off between the performance of the global model and the privacy of the participants' sensitive data. In other words, since the FL paradigm aims to expose as little information about the individual participants' data as possible, recognizing and mitigating the presence of poisoned data samples is not easy [3]}. Therefore, despite the existing detection and mitigation solutions, such as the usage of clustering techniques to detect anomalies in model parameters [6]} or the use of secure aggregation functions to remove noisy weights [7]}, no robust solution exists nowadays.
